Analysis
-
max time kernel
50s -
max time network
10s -
platform
windows10_x64 -
resource
win10v200410 -
submitted
20-04-2020 15:41
Static task
static1
Behavioral task
behavioral1
Sample
launch.bat
Resource
win7v200410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
launch.bat
Resource
win10v200410
windows10_x64
0 signatures
0 seconds
General
-
Target
launch.bat
-
Size
68B
-
MD5
fc9df43a0e518e46173810698bb61f2b
-
SHA1
d349c3a95356d0f97707b79495753bd03653f629
-
SHA256
d74870a0ba0e9cc7388bef1b4de9c09f6316a9ccf8e3191cdf6809e8032873ad
-
SHA512
84fec80449e9b5b1ddb150f6bda64b79435a38111273ab57e92a4ceeaa44c4c320eb9e02cc5384dbf281e52c936b14602826c54c8999e9df23cfe7e5800293d0
Score
10/10
Malware Config
Signatures
-
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6adf0c9499063782.tmp regsvr32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6adf0c9499063782.tmp regsvr32.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\111.bmp" regsvr32.exe -
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Maze
Ransomware family also known as ChaCha.
-
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3660 wrote to memory of 3688 3660 regsvr32.exe 70 PID 3660 wrote to memory of 3688 3660 regsvr32.exe 70 PID 3660 wrote to memory of 3688 3660 regsvr32.exe 70 PID 3688 wrote to memory of 3472 3688 regsvr32.exe 75 PID 3688 wrote to memory of 3472 3688 regsvr32.exe 75 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3688 regsvr32.exe 3688 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 4072 vssvc.exe Token: SeRestorePrivilege 4072 vssvc.exe Token: SeAuditPrivilege 4072 vssvc.exe Token: SeIncreaseQuotaPrivilege 3472 wmic.exe Token: SeSecurityPrivilege 3472 wmic.exe Token: SeTakeOwnershipPrivilege 3472 wmic.exe Token: SeLoadDriverPrivilege 3472 wmic.exe Token: SeSystemProfilePrivilege 3472 wmic.exe Token: SeSystemtimePrivilege 3472 wmic.exe Token: SeProfSingleProcessPrivilege 3472 wmic.exe Token: SeIncBasePriorityPrivilege 3472 wmic.exe Token: SeCreatePagefilePrivilege 3472 wmic.exe Token: SeBackupPrivilege 3472 wmic.exe Token: SeRestorePrivilege 3472 wmic.exe Token: SeShutdownPrivilege 3472 wmic.exe Token: SeDebugPrivilege 3472 wmic.exe Token: SeSystemEnvironmentPrivilege 3472 wmic.exe Token: SeRemoteShutdownPrivilege 3472 wmic.exe Token: SeUndockPrivilege 3472 wmic.exe Token: SeManageVolumePrivilege 3472 wmic.exe Token: 33 3472 wmic.exe Token: 34 3472 wmic.exe Token: 35 3472 wmic.exe Token: 36 3472 wmic.exe Token: SeIncreaseQuotaPrivilege 3472 wmic.exe Token: SeSecurityPrivilege 3472 wmic.exe Token: SeTakeOwnershipPrivilege 3472 wmic.exe Token: SeLoadDriverPrivilege 3472 wmic.exe Token: SeSystemProfilePrivilege 3472 wmic.exe Token: SeSystemtimePrivilege 3472 wmic.exe Token: SeProfSingleProcessPrivilege 3472 wmic.exe Token: SeIncBasePriorityPrivilege 3472 wmic.exe Token: SeCreatePagefilePrivilege 3472 wmic.exe Token: SeBackupPrivilege 3472 wmic.exe Token: SeRestorePrivilege 3472 wmic.exe Token: SeShutdownPrivilege 3472 wmic.exe Token: SeDebugPrivilege 3472 wmic.exe Token: SeSystemEnvironmentPrivilege 3472 wmic.exe Token: SeRemoteShutdownPrivilege 3472 wmic.exe Token: SeUndockPrivilege 3472 wmic.exe Token: SeManageVolumePrivilege 3472 wmic.exe Token: 33 3472 wmic.exe Token: 34 3472 wmic.exe Token: 35 3472 wmic.exe Token: 36 3472 wmic.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops file in Program Files directory 43 IoCs
description ioc Process File opened for modification C:\Program Files\ImportWatch.htm regsvr32.exe File opened for modification C:\Program Files\RedoHide.xml regsvr32.exe File opened for modification C:\Program Files\RedoUninstall.mpeg3 regsvr32.exe File opened for modification C:\Program Files\ResolveWait.mp4 regsvr32.exe File opened for modification C:\Program Files\SubmitConvertTo.rar regsvr32.exe File opened for modification C:\Program Files\UninstallCheckpoint.dib regsvr32.exe File opened for modification C:\Program Files\DisableUnlock.emf regsvr32.exe File opened for modification C:\Program Files\HideExport.AAC regsvr32.exe File opened for modification C:\Program Files\MeasureExpand.cmd regsvr32.exe File opened for modification C:\Program Files\NewExport.m1v regsvr32.exe File opened for modification C:\Program Files\RenameUnblock.ram regsvr32.exe File opened for modification C:\Program Files\SaveUnblock.mp2v regsvr32.exe File opened for modification C:\Program Files\SetProtect.DVR regsvr32.exe File opened for modification C:\Program Files\SyncShow.ods regsvr32.exe File opened for modification C:\Program Files\UnprotectImport.kix regsvr32.exe File opened for modification C:\Program Files\ReceiveConfirm.wmf regsvr32.exe File opened for modification C:\Program Files\SplitSubmit.wdp regsvr32.exe File opened for modification C:\Program Files\SwitchDeny.ttf regsvr32.exe File opened for modification C:\Program Files\6adf0c9499063782.tmp regsvr32.exe File opened for modification C:\Program Files\DismountClose.odp regsvr32.exe File opened for modification C:\Program Files\PingGet.DVR regsvr32.exe File opened for modification C:\Program Files\ReadMount.3g2 regsvr32.exe File opened for modification C:\Program Files\RequestMeasure.odt regsvr32.exe File opened for modification C:\Program Files\SkipReset.vsd regsvr32.exe File opened for modification C:\Program Files\RestoreRegister.mht regsvr32.exe File opened for modification C:\Program Files\SubmitHide.xhtml regsvr32.exe File opened for modification C:\Program Files\UninstallCopy.rm regsvr32.exe File opened for modification C:\Program Files\SubmitWatch.gif regsvr32.exe File opened for modification C:\Program Files\UnblockDisconnect.m4v regsvr32.exe File opened for modification C:\Program Files\ApproveResize.mpeg regsvr32.exe File opened for modification C:\Program Files\ClearCompare.vsd regsvr32.exe File opened for modification C:\Program Files\ExportDisconnect.mhtml regsvr32.exe File opened for modification C:\Program Files\GetBlock.emz regsvr32.exe File opened for modification C:\Program Files\MoveExpand.wmf regsvr32.exe File opened for modification C:\Program Files\RemoveLimit.wmv regsvr32.exe File opened for modification C:\Program Files\UnprotectUpdate.png regsvr32.exe File opened for modification C:\Program Files (x86)\6adf0c9499063782.tmp regsvr32.exe File created C:\Program Files\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\DebugJoin.snd regsvr32.exe File opened for modification C:\Program Files\LimitClear.avi regsvr32.exe File opened for modification C:\Program Files\PublishClose.dotx regsvr32.exe File opened for modification C:\Program Files\ResumeMove.aifc regsvr32.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt regsvr32.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launch.bat"1⤵PID:2572
-
C:\Windows\system32\regsvr32.exeregsvr32 "C:\Users\Admin\AppData\Local\temp\kepstl32.dll"2⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Users\Admin\AppData\Local\temp\kepstl32.dll"3⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
PID:3688 -
C:\Windows\system32\wbem\wmic.exe"C:\rwg\ngbw\..\..\Windows\r\kvwle\lgp\..\..\..\system32\iar\sjl\ixom\..\..\..\wbem\if\jacf\..\..\wmic.exe" shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:4072